RATATOSKRATATOSK
로그인

Kubernetes

v1.37.0Kubernetes Core
2026년 8월 26일

ACTION 6CHECK 35PLAN 5OTHER 403

새 기능과 API 확장, 스케줄링 및 노드 동작 개선, 성숙도 승격, 정확성 및 성능 수정이 폭넓게 포함된 주요 API 릴리스입니다. SELinux와 `kubelet` 설정 변경, API 및 기능 게이트 제거, 사용 중단된 인터페이스 정리, 기본값 및 검증 변경으로 매니페스트, 클라이언트, 클러스터 설정을 조정해야 할 수 있으므로 업그레이드를 신중히 계획해야 합니다.

조치 필요 (6)

  • security잘못된 객체 삭제의 어드미션 우회 경로 제거

    잘못된 객체 삭제가 어드미션을 우회하고, 정상 객체의 유예 삭제에 영향을 줄 수 있던 예외 처리를 제거했습니다.

  • breakingWatchListCompression 기본 활성화

    WatchListCompression 관련 동작이 기본으로 활성화됐습니다. WatchListCompression 기능 게이트로 비활성화할 수 있습니다.

  • breakingEtcdRangeStream 베타 승격 및 기본 활성화

    EtcdRangeStream 기능 게이트가 베타로 승격됐으며 기본으로 활성화됩니다.

  • breakingAllowUnsafeMalformedObjectDeletion 기본 활성화

    AllowUnsafeMalformedObjectDeletion 기능 게이트가 베타로 승격돼 기본 활성화됩니다. 스토리지에서 읽을 수 없는 객체의 목록 오류에는 최초 원인도 포함됩니다.

  • breakingPodLevelResourceManagers 기본 비활성화

    릴리스 전 발견된 문제로 PodLevelResourceManagers 기능 게이트를 기본 비활성화했습니다.

  • breakingkube-scheduler의 목록형 특성 평가 유지

    ListTypeAttributes 기능 게이트가 비활성화돼도 kube-scheduler가 목록형 특성, .includes 함수, CEL 매크로를 평가합니다. 롤링 업그레이드 중이거나 기능 게이트를 전환할 때 발생하던 오류를 막습니다.

영향 확인 (35)

  • securitykubeconfig 이전 시 파일 권한 유지

    이전을 위해 kubeconfig 파일을 설정한 경우에 해당합니다.

    client-go가 kubeconfig 파일을 이전할 때 원본 파일의 권한을 유지합니다. 이전에는 대상 파일이 더 넓은 권한으로 만들어져 같은 시스템의 다른 사용자에게 자격 증명이 노출될 수 있었습니다.

  • breakingSELinuxMount 기본 활성화

    클러스터에서 SELinux를 활성화한 경우에 해당합니다.

    SELinuxMount 기능이 v1.37부터 기본 활성화됩니다. SELinux가 활성화된 클러스터에서는 기존 워크로드가 중단될 수 있습니다.

  • breakingWorkload-Aware Scheduling API의 v1beta1 승격

    scheduling.k8s.io/v1alpha2 또는 scheduling.k8s.io/v1beta1을 사용하는 경우에 해당합니다.

    핵심 Workload-Aware Scheduling API 타입인 Workload와 PodGroup이 scheduling.k8s.io/v1beta1로 승격됐습니다.

  • breakingDisruptionMode 필드 형식 변경

    DisruptionMode를 사용하는 경우에 해당합니다.

    향후 확장을 지원하도록 DisruptionMode 열거형 필드가 구조체로 바뀌었습니다.

  • breakingeventRecordQPS=0의 무제한 처리

    eventRecordQPS를 설정한 경우에 해당합니다.

    kubelet 설정의 eventRecordQPS에서 값 0을 무제한, 즉 속도 제한 없음으로 처리하도록 수정했습니다.

  • breaking더 이상 지원하지 않는 cAdvisor 플래그 거부

    --application-metrics-count-limit, --boot-id-file, --container-hints, --containerd, --containerd-namespace, --enable-load-reader, --event-storage-age-limit, --event-storage-event-limit, --global-housekeeping-interval, --log-cadvisor-usage, --machine-id-file, --storage-driver-user, --storage-driver-password, --storage-driver-host, --storage-driver-db, --storage-driver-table, --storage-driver-secure, --storage-driver-buffer-duration 중 하나를 설정한 경우에 해당합니다.

    더 이상 지원하지 않는 cAdvisor 플래그를 허용하지 않습니다. 해당 플래그가 설정되면 kubelet이 시작하지 못합니다.

  • breakingDeclarativeValidationTakeover 설정 불가

    DeclarativeValidationTakeover를 설정한 경우에 해당합니다.

    DeclarativeValidationTakeover는 더 이상 설정할 수 없습니다.

  • breakingPodCertificateRequest v1의 필드 제거

    PodCertificateRequest v1beta1을 사용하는 경우에 해당합니다.

    PodCertificateRequest v1beta1에서 사용 중단 예정이었던 PKIXPublicKey 및 ProofOfPossession 필드가 v1 API에서 제거됐습니다.

  • breakingPKIXPublicKey 및 ProofOfPossession 제거

    PKIXPublicKey 또는 ProofOfPossession을 사용하는 경우에 해당합니다.

    PKIXPublicKey와 ProofOfPossession이 v1 API에서 제거됐습니다.

  • breakingHostnameOverride 활성화 고정

    HostnameOverride를 설정한 경우에 해당합니다.

    HostnameOverride 기능 게이트가 활성화 상태로 고정됐습니다.

  • breakingDRAPlugin.WatchHealthStatus 필수화

    DRAPlugin.WatchHealthStatus를 사용하는 경우에 해당합니다.

    DRAPlugin.WatchHealthStatus가 필수 메서드가 됐습니다.

  • breakingGangScheduling 및 WorkloadAwarePreemption 제거

    GangScheduling 또는 WorkloadAwarePreemption을 설정한 경우에 해당합니다.

    GangScheduling 및 WorkloadAwarePreemption 기능 게이트가 제거됐습니다. 대신 GenericWorkload 기능 게이트를 사용합니다.

  • breakingAnyVolumeDataSource 기능 게이트 제거

    AnyVolumeDataSource를 설정한 경우에 해당합니다.

    정식 출시 상태였던 AnyVolumeDataSource 기능 게이트가 제거됐습니다.

  • breaking어드미션 웹훅 요청의 균등 분산

    --enable-aggregator-routing=true를 설정한 경우에 해당합니다.

    --enable-aggregator-routing=true인 kube-apiserver가 어드미션 웹훅 엔드포인트에 요청을 고르게 분산합니다. WebhookRoundTripLoadBalancing은 베타 기능이며 기본 활성화 상태이고, 일시적으로 이전 동작을 선택할 수 있습니다.

  • breakingHPA의 0까지 축소 및 0에서 확장 기본 활성화

    HorizontalPodAutoscaler(HPA)를 사용하는 경우에 해당합니다.

    HorizontalPodAutoscaler(HPA)의 0까지 축소와 0에서 확장이 기본으로 활성화됐습니다.

  • breakingMaxUnavailableStatefulSet 기본 활성화

    MaxUnavailableStatefulSet을 사용하는 경우에 해당합니다.

    MaxUnavailableStatefulSet 기능이 기본으로 활성화됐습니다.

  • breaking어드미션 웹훅의 가상 리소스 제외

    어드미션 웹훅을 사용하는 경우에 해당합니다.

    어드미션 웹훅이 tokenreviews, subjectaccessreviews 같은 인증 및 권한 확인 가상 리소스를 건너뜁니다. ExcludeAdmissionWebhookVirtualResources는 기본 활성화된 베타 기능 게이트이며, 이전 동작으로 되돌릴 수 있습니다.

  • breakingNodeLocalCRISocket 기능 게이트 제거

    kubeadm을 실행하는 경우에 해당합니다.

    kubeadm에서 NodeLocalCRISocket 기능 게이트가 제거됐습니다. 이 기능은 이전 릴리스에서 정식 출시되고 기본 활성화 상태로 고정됐습니다.

  • breakingHPAOptimizedSelectorStore 기본 활성화

    HorizontalPodAutoscaler 컨트롤러를 실행하는 경우에 해당합니다.

    HPA 컨트롤러의 선택기 중복 감지에서 잠금 경합을 줄이기 위한 HPAOptimizedSelectorStore 기능 게이트가 추가됐습니다. 이 베타 기능은 기본으로 활성화되며, HPA 수와 동시 실행 수가 많은 상황의 조정 처리량을 높입니다.

  • breaking사용자 지정 열 출력의 --label-columns 오류 처리

    --label-columns를 설정한 경우에 해당합니다.

    사용자 지정 열 출력에서 --label-columns를 함께 사용하면 kubectl get이 오류를 반환합니다.

  • breaking빈 image.reference 필드 거부

    image.reference를 설정한 경우에 해당합니다.

    Deployment, StatefulSet, DaemonSet, Job 등의 Pod 템플릿에서 비어 있는 image.reference 필드를 거부합니다.

  • breakingkubelet 로그 엔드포인트의 HTTP 메서드 제한

    kubelet을 실행하는 경우에 해당합니다.

    kubelet의 로그 관련 엔드포인트가 HTTP 메서드를 명시적으로 제한합니다. 읽기 전용 kubelet 서버 엔드포인트는 GET 이외의 메서드에 405를 반환하고, NodeLogQuery는 GET과 POST만 허용합니다.

  • breakingnftables 모드의 netlink 기본 활성화

    kube-proxy nftables 모드를 실행하는 경우에 해당합니다.

    kube-proxy nftables 모드에서 netlink 지원이 기본으로 활성화됐습니다.

  • breakingPodGroup 검증 알파 어드미션 플러그인 제거

    알파 어드미션 플러그인을 사용하는 경우에 해당합니다.

    PodGroup이 기존 Workload를 참조하고 선언된 PodGroupTemplate 사양과 일치하는지 검증하던 알파 어드미션 플러그인이 제거됐습니다.

  • breakingNode 네트워크 변경 시 kube-proxy 종료

    kube-proxy를 실행하는 경우에 해당합니다.

    감시 중인 Node의 IP가 바뀌거나 Node 객체가 삭제되면 kube-proxy가 종료됩니다. 재시작 시 변경된 노드 네트워크 상태를 반영합니다.

  • breakinghugepage 노드의 memory.available 계산 변경

    노드에서 hugepages를 사용하는 경우에 해당합니다.

    hugepages를 사용하는 노드에서 kubelet 축출 관리자가 memory.available 계산의 AvailableBytes에서 hugepage 예약 RAM을 제외합니다. 기본 활성화된 HugepageAwareEviction 기능 게이트를 비활성화하면 이전 동작으로 되돌아갑니다.

  • breakingDRAPrioritizedList 활성화 고정

    DRA를 사용하는 경우에 해당합니다.

    DRA의 Prioritized List 기능이 v1.36에서 정식 출시됨에 따라 DRAPrioritizedList 기능 게이트가 기본 활성화 상태로 고정됐습니다. 더 이상 비활성화할 수 없습니다.

  • breakingRelaxedDNSSearchValidation 기능 게이트 제거

    RelaxedDNSSearchValidation을 설정한 경우에 해당합니다.

    RelaxedDNSSearchValidation 기능 게이트가 제거됐습니다.

  • breaking고정된 정식 출시 기능 게이트 제거

    RetryGenerateName, BtreeWatchCache, OrderedNamespaceDeletion, StreamingCollectionEncodingToJSON, StreamingCollectionEncodingToProtobuf, APIServerTracing, ResilientWatchCacheInitialization, ConsistentListFromCache 중 하나를 설정한 경우에 해당합니다.

    정식 출시 상태로 고정돼 있던 RetryGenerateName, BtreeWatchCache, OrderedNamespaceDeletion, StreamingCollectionEncodingToJSON, StreamingCollectionEncodingToProtobuf, APIServerTracing, ResilientWatchCacheInitialization, ConsistentListFromCache 기능 게이트가 제거됐습니다.

  • breaking--concurrent-service-syncs 플래그 제거

    --concurrent-service-syncs를 설정한 경우에 해당합니다.

    kube-controller-manager의 --concurrent-service-syncs 플래그가 제거됐습니다. 이 플래그는 v1.31부터 동작하지 않았습니다.

  • breakingPreventStaticPodAPIReferences 기능 게이트 제거

    PreventStaticPodAPIReferences를 설정한 경우에 해당합니다.

    PreventStaticPodAPIReferences 기능 게이트가 제거됐습니다. 정적 Pod는 더 이상 API 리소스를 참조할 수 없으며, 이 동작을 비활성화할 수도 없습니다.

  • breakingSidecarContainers 기능 게이트 제거

    SidecarContainers를 설정한 경우에 해당합니다.

    v1.33부터 무조건 활성화돼 있던 SidecarContainers 기능 게이트가 제거됐습니다.

  • breaking기존 API 서버 캐시 목록 메트릭 기본 비노출

    apiserver_cache_list_total, apiserver_cache_list_fetched_objects_total 또는 apiserver_cache_list_returned_objects_total을 사용하는 경우에 해당합니다.

    사용 중단 예정이었던 알파 메트릭 apiserver_cache_list_total, apiserver_cache_list_fetched_objects_total, apiserver_cache_list_returned_objects_total이 더 이상 기본으로 노출되지 않습니다. 통합 메트릭 apiserver_storage_list_*에서 storage="watchcache" 레이블을 사용합니다.

  • breakingDefaultWatchCacheSize 필드 제거

    DefaultWatchCacheSize를 설정한 경우에 해당합니다.

    k8s.io/apiserver/pkg/server/options.EtcdOptions의 동작하지 않던 DefaultWatchCacheSize 필드가 제거됐습니다.

  • breakingkubeadm v1beta3 API 및 PublicKeysECDSA 제거

    v1beta3 API를 사용하거나 PublicKeysECDSA를 설정한 경우에 해당합니다.

    kubeadm의 v1beta3 API와 하위 호환용 PublicKeysECDSA 기능 게이트가 제거됐습니다. ECDSA 키 지원은 v1beta4의 ClusterConfiguration.EncryptionAlgorithm 필드에서 설정하며, v1beta4를 복제한 실험용 v1 API는 아직 사용할 수 없습니다.

미리 준비 (5)

  • deprecatedkube-proxy ipvs 모드 사용 중단 예정v1.35부터

    kube-proxy의 ipvs 모드를 실행하는 경우에 해당합니다.

    kube-proxy의 ipvs 모드는 v1.35부터 사용 중단 예정 상태입니다.

  • deprecatedv1alpha1 DRAResourceHealth API 사용 중단 예정v1.40에서 제거 예정

    v1alpha1 DRAResourceHealth API를 사용하는 경우에 해당합니다.

    v1alpha1 DRAResourceHealth API가 사용 중단 예정 상태가 됐으며, v1.40에서 제거될 예정입니다.

  • deprecatedkubectl run의 --filename 및 -f 사용 중단 예정

    --filename 또는 -f를 설정한 경우에 해당합니다.

    kubectl run에서 무시되던 --filename 및 -f 플래그를 더 이상 사용하지 않도록 표시했습니다.

  • deprecatedclient-go 기존 API 사용 중단 예정

    적용 대상이 릴리스 노트에 명시되지 않았습니다.

    client-go의 기존 API가 사용 중단 예정으로 표시됐습니다. 제거할 계획은 없습니다.

  • deprecated리더 선출 resourcelock API 사용 중단 예정

    MultiLock, UnknownLeader 또는 ConcatRawRecord를 사용하는 경우에 해당합니다.

    client-go 리더 선출 resourcelock 패키지의 MultiLock, UnknownLeader, ConcatRawRecord가 사용 중단 예정 상태가 됐습니다.

그 외 기록된 변경 403건 전체value changes 171 · fixes 123 · additions 75 · constraints 17 · defaults 10 · renames 5 · removals 2

value changes (171)

  • Updated google.golang.org/grpc to v1.82.1
  • Updated the default etcd version to v3.7.0.
  • Updated the etcd client library to v3.6.10.
  • conditions to optionally include the observedGeneration
  • encode collections item by item instead of all at once.
  • Improved CEL error messages in Dynamic Resource Allocation
  • Promoted DRA Workload resource claims to Beta.
  • Promoted kubelet volume metrics
  • Promoted the DRA Device Taints and Tolerations feature to GA
  • Promoted the DRA extended resource feature to GA in v1.37.
  • Promoted the DRA metadata API to Beta.
  • Promoted the HPAConfigurableTolerance feature gate to GA.
  • Promoted the KubeletInUserNamespace feature gate to Beta.
  • Promoted the MemoryQoS feature gate to Beta.
  • Promoted the NodeDeclaredFeatures feature gate to GA.
  • Promoted the VolumeLimitScaling feature gate
  • Promoted the metrics.k8s.io API from v1beta1 to v1 without changes.
  • Updated CDI spec version selection to be dynamic, preventing the generation of incompatible CDI specifications.
  • Empty Pod resources ({}, {requests:{}}, or {limits:{}}) no longer affect QoS calculation.
  • Updated the Alpha DRANodeAllocatableResources feature
  • Added cpu_ids and memory fields at the pod level to the PodResources v1 API to report total allocated pod resources, while only returning container-level allocations for container-isolated containers.
  • Added structured CauseType values to PodDisruptionBudget-related eviction Forbidden errors in the eviction API, allowing clients to programmatically distinguish PDB invalid-state errors from other forbidden errors without string-matching on the message.
  • Added the cache_to_watcher stage to the Alpha apiserver_watch_events_dispatch_duration_seconds metric to measure the latency incurred when pushing events to a watcher's result channel.
  • Added the storage_to_cache stage to the Alpha apiserver_watch_events_dispatch_duration_seconds metric to track the latency from backend decode to watch cache ingestion.
  • Changed PodGroup preemption to run after a failed PodGroup scheduling attempt for PodGroups with scheduling constraints.
  • Demoted the SchedulerPreQueueingHints feature gate from Beta to Alpha, disabled by default, because of issues found shortly before release.
  • Updated pod group preemption errors to be prefixed with pod group preemption: message.
  • Graduated WatchCacheInitializationPostStartHook to GA.
  • Graduated the NativeHistograms feature gate to Beta.
  • Graduated the RelaxedServiceNameValidation feature gate to GA.
  • Graduated the scheduler_plugin_execution_duration_seconds and scheduler_scheduling_algorithm_duration_seconds metrics from Alpha to Beta.
  • Improved node health checks by verifying lease staleness with a live GET before marking nodes unhealthy, avoiding false positives from stale cache.
  • Improved scheduling performance for required Pod affinity and anti-affinity with topologyKey: kubernetes.io/hostname, behind the InterPodAffinityHostnameFastPath feature gate.
  • Optimized CEL admission policy evaluation by adopting a lazy zero-allocation reflection-based utility for object traversal, significantly reducing CPU usage and garbage collection overhead during request processing.
  • Optimized kube-scheduler performance for Pods with PersistentVolumeClaim mounts by processing only delta counts between scheduling cycles.
  • Promoted serviceaccount_legacy_tokens_total, serviceaccount_stale_tokens_total and serviceaccount_valid_tokens_total to Beta.
  • Promoted support for kubectl get -o kyaml to Stable.
  • Promoted the DRAResourceClaimDeviceStatus feature gate to GA.
  • Promoted the InPlacePodVerticalScalingInitContainers feature gate to GA.
  • Promoted the PLEGOnDemandRelist feature gate to GA.
  • Promoted the PodAndContainerStatsFromCRI feature gate to Beta, disabled by default.
  • Promoted the PodReadyToStartContainers condition to GA.
  • Promoted the kube-apiserver webhook metrics apiserver_webhooks_x509_missing_san_total and apiserver_webhooks_x509_insecure_sha1_total to Beta and updated their documentation.
  • Promoted the kubelet PodsAPI gRPC service to Beta.
  • Set the nominatedNodeName field on pods from a PodGroup after a successful PodGroup preemption, consistent with single-pod preemption.
  • Updated the apiserver_storage_list_* metrics to include storage and index labels to distinguish the storage backend and lookup path used to serve LIST requests.
  • Updated the scheduler to avoid redundant preemption attempts during PodGroup scheduling when terminating victim pods are already present on the nominated nodes.
  • Updated CoreDNS to ….×3
  • Updated PodGroup scheduling to requeue remaining unscheduled Pods directly to the active queue (rather than backoff queue) after successful PodGroup scheduling, preserving their original timestamps so they retain scheduling precedence unless a higher priority entity is added.
  • Updated PodGroup status to include the pod group preemption found a placement for podgroup, preempting <victim_count> victims message when workload-aware preemption finds a placement.
  • Updated cri-tools to v1.36.0.
  • Updated default preemption to include the message preemption: found a potential placement for pod on node <node_name>, preempting <victim_count> victims in the FailedScheduling event and PodScheduled condition when it finds a potential Node for a Pod.
  • Updated the Go version used to build Kubernetes to ….×5
  • Updated the WorkloadAwarePreemption feature to perform a single scheduling attempt with all potential victims removed. This significantly improves performance but can result in a less optimal choice of preemption victims.
  • Updated volume mount host path type mismatch errors to log the actual path type alongside the expected one.
  • Updated workload-aware preemption to preempt victims so that as many as possible of the preemptor pods can be scheduled.
  • Deferred syncing an HPA object in the HPA controller when the controller has not yet observed HPA status writes from the last time the object was synced.
  • kubeadm: Changed the preflight Port-xx checks for kube-apiserver, kube-scheduler, kube-controller-manager, and etcd to bind to the address configured in the kubeadm config for the respective component (via the localAPIEndpoint.address field or the --bind-address extraArgs override), instead of calling net.Listen() without an address (which binds to all available unicast and anycast IP addresses for the port).
  • kubelet: Deferred the deprecation removal timeline for the configuration flags (and the related fallback behavior) from v1.37 to v1.38 to align with containerd v1.7 support.
  • Added the group name to the kubectl error message when a resource type is not found under the specified group, for example the server doesn't have a resource type "pdb" in group "hpa".
  • Avoided costly comparisons during SELinux metric emission.
  • Changed client-go RetryWatcher to log 410 Gone (resource expired) errors at debug verbosity (V(4)) instead of ERROR level during watch establishment.
  • Changed kube-proxy to skip full-sync operations when operating in large-cluster mode (more than 1000 endpoints).
  • Changed the HPA controller to reconcile newly created and spec-changed HPAs immediately instead of waiting for the full resync period (default 15s).
  • - Improved error reporting when invoking kubectl exec.
  • - Improved the logic in kubeadm around warnings when a user sets a non-default bindAddress in KubeProxyConfiguration.
  • - Reverted the cri-api KeyValue value field to its pre-v1.34 JSON encoding behavior for compatibility with earlier releases.
  • - Surfaced the error reason when invalid service CIDRs are configured.
  • - Updated kubectl run error messages for invalid --restart and --image-pull-policy values to list the accepted values.
  • - Updated the PodGroup status.conditions field to reflect the failure reason when scheduling is rejected due to mismatched .spec.schedulerName across Pods in a group.
  • - Updated the PodReadyToStartContainers condition to include a diagnostic message when status is False, explaining why the pod sandbox is not ready (for example, pod sandbox has no IP address or no pod sandbox exists). This improves debuggability for Pods stuck in ContainerCreating without requiring access to node logs.
  • - Updated the kubelet to no longer emit V(4) "Label not found" logs for missing optional container annotations.
  • - Updated the version of the nft binary in the kube-proxy image to nftables v1.0.6.1 to fix issues resyncing kube-proxy in nftables mode on systems containing rules created by recent versions of nftables.
  • - kubelet: Changed the DefaultPodSysctls feature to treat an unset spec.hostUsers as true when evaluating user.* sysctls.
  • - Changed MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding storage in etcd to use the admissionregistration.k8s.io/v1 API version.
  • - Changed ResourceClaim config status to leave the requests field empty when the configuration applies to all requests.
  • - Changed the kube-apiserver service/proxy subresource to use EndpointSlices instead of Endpoints when proxying to a Service. This change only affects clusters that manually create Endpoints for a Service and have EndpointSlice mirroring disabled.
  • - Changed the scheduler's opportunistic batching to rescore the previously chosen node when it is still feasible, allowing it to compete with cached candidates for the next hint rather than always being skipped.
  • - Improved kubelet Topology Manager error messages when the prefer-closest-numa-nodes policy option is enabled on Windows nodes that do not expose NUMA distance information, clarifying that the option is not supported on those nodes.
  • - Improved memory usage of kube-proxy by dropping the .metadata.managedFields field, which kube-proxy does not require.
  • - Promoted apiserver_watch_events_total and apiserver_watch_events_sizes to Beta.
  • - Stopped using maps for single-endpoint Services in kube-proxy nftables mode, increasing the speed of programming nftables.
  • - Switched StorageVersionMigration to use merge patch instead of SSA.
  • - The kube-apiserver --enable-logs-handler flag, deprecated in v1.15, is no longer marked deprecated. It remains off by default.
  • - Updated the etcd client library to v3.6.11.
  • - kubeadm: Updated the supported etcd version to v3.6.11 for supported control plane versions v1.34, v1.35, and v1.36.
  • - cyphar.com/go-pathrs: [v0.2.2 → v0.2.5](https://github.com/cyphar/libpathrs.git/compare/go-pathrs/v0.2.2...go-pathrs/v0.2.5)
  • - github.com/Azure/go-ansiterm: [306776e → faa5f7b](https://github.com/Azure/go-ansiterm/compare/306776e...faa5f7b)
  • - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: [v1.30.0 → v1.32.0](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/compare/v1.30.0...v1.32.0)
  • - github.com/Microsoft/hnslib: [v0.1.2 → v0.1.3](https://github.com/Microsoft/hnslib/compare/v0.1.2...v0.1.3)
  • - github.com/antlr4-go/antlr/v4: [v4.13.0 → v4.13.1](https://github.com/antlr4-go/antlr/compare/v4.13.0...v4.13.1)
  • - github.com/cncf/xds/go: [ee656c7 → dba9d58](https://github.com/cncf/xds/compare/ee656c7534f5d7dc23d44dd611689568f72017a6...dba9d589def2cd10099a3a64887d859188c2f57a)
  • - github.com/container-storage-interface/spec: [v1.9.0 → cd9e7ad](https://github.com/container-storage-interface/spec/compare/v1.9.0...cd9e7ad1ae0915cabcad179f2b8a660c0cb6eb9f)
  • - github.com/containerd/containerd/api: [v1.10.0 → v1.11.1](https://github.com/containerd/containerd/compare/api/v1.10.0...api/v1.11.1)
  • - github.com/containerd/ttrpc: [v1.2.7 → v1.2.9](https://github.com/containerd/ttrpc/compare/v1.2.7...v1.2.9)
  • - github.com/containerd/typeurl/v2: [v2.2.3 → v2.3.0](https://github.com/containerd/typeurl/compare/v2.2.3...v2.3.0)
  • - github.com/coredns/corefile-migration: [v1.0.31 → v1.0.34](https://github.com/coredns/corefile-migration/compare/v1.0.31...v1.0.34)
  • - github.com/cyphar/filepath-securejoin: [v0.6.1 → v0.7.0](https://github.com/cyphar/filepath-securejoin/compare/v0.6.1...v0.7.0)
  • - github.com/envoyproxy/go-control-plane/envoy: [v1.36.0 → v1.37.0](https://github.com/envoyproxy/go-control-plane/compare/envoy/v1.36.0...envoy/v1.37.0)
  • - github.com/envoyproxy/protoc-gen-validate: [v1.3.0 → v1.3.3](https://github.com/envoyproxy/protoc-gen-validate/compare/v1.3.0...v1.3.3)
  • - github.com/fxamacker/cbor/v2: [v2.9.0 → v2.9.1](https://github.com/fxamacker/cbor/compare/v2.9.0...v2.9.1)
  • - github.com/go-jose/go-jose/v4: [v4.1.3 → v4.1.4](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)
  • - github.com/go-openapi/jsonpointer: [v0.21.0 → v1.0.0](https://github.com/go-openapi/jsonpointer/compare/v0.21.0...v1.0.0)
  • - github.com/go-openapi/jsonreference: [v0.20.2 → v1.0.0](https://github.com/go-openapi/jsonreference/compare/v0.20.2...v1.0.0)
  • - github.com/go-openapi/swag: [v0.23.0 → v0.27.1](https://github.com/go-openapi/swag/compare/v0.23.0...v0.27.1)
  • - github.com/golang-jwt/jwt/v5: [v5.3.0 → v5.3.1](https://github.com/golang-jwt/jwt/compare/v5.3.0...v5.3.1)
  • - github.com/google/cel-go: [v0.26.0 → v0.29.2](https://github.com/google/cel-go/compare/v0.26.0...v0.29.2)
  • - github.com/google/pprof: [294ebfa → 545e8a4](https://github.com/google/pprof/compare/294ebfa9ad836ed3d00d43d54ea599339e403110...545e8a4df9364095d66e521b8f515f7af961e653)
  • - github.com/grpc-ecosystem/grpc-gateway/v2: [v2.27.7 → v2.29.0](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.7...v2.29.0)
  • - github.com/klauspost/compress: [v1.18.0 → v1.19.0](https://github.com/klauspost/compress/compare/v1.18.0...v1.19.0)
  • - github.com/moby/term: [v0.5.0 → v0.5.2](https://github.com/moby/term/compare/main...v0.5.2)
  • - github.com/onsi/ginkgo/v2: [v2.28.1 → v2.32.0](https://github.com/onsi/ginkgo/compare/v2.28.1...v2.32.0)
  • - github.com/onsi/gomega: [v1.39.1 → v1.40.0](https://github.com/onsi/gomega/compare/v1.39.1...v1.40.0)
  • - github.com/opencontainers/cgroups: [v0.0.6 → v0.0.7](https://github.com/opencontainers/cgroups/compare/v0.0.6...v0.0.7)
  • - github.com/opencontainers/selinux: [v1.13.1 → v1.15.1](https://github.com/opencontainers/selinux/compare/v1.13.1...v1.15.1)
  • - github.com/prometheus/client_golang: [v1.23.2 → v1.24.0](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0)
  • - github.com/prometheus/common: [v0.67.5 → v0.70.0](https://github.com/prometheus/common/compare/v0.67.5...v0.70.0)
  • - github.com/prometheus/procfs: [v0.19.2 → v0.21.1](https://github.com/prometheus/procfs/compare/v0.19.2...v0.21.1)
  • - github.com/sirupsen/logrus: [v1.9.3 → v1.9.4](https://github.com/sirupsen/logrus/compare/v1.9.3...v1.9.4)
  • - github.com/spf13/pflag: [v1.0.9 → v1.0.10](https://github.com/spf13/pflag/compare/v1.0.9...v1.0.10)
  • - github.com/stretchr/objx: [v0.5.2 → v0.5.3](https://github.com/stretchr/objx/compare/v0.5.2...v0.5.3)
  • - go.etcd.io/bbolt: [v1.4.3 → v1.5.0](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0)
  • - go.etcd.io/etcd/api/v3: [v3.6.8 → v3.7.0](https://github.com/etcd-io/etcd/compare/api/v3.6.8...api/v3.7.0)
  • - go.etcd.io/etcd/client/pkg/v3: [v3.6.8 → v3.7.0](https://github.com/etcd-io/etcd/compare/client/pkg/v3.6.8...client/pkg/v3.7.0)
  • - go.etcd.io/etcd/client/v3: [v3.6.8 → v3.7.0](https://github.com/etcd-io/etcd/compare/client/v3.6.8...client/v3.7.0)
  • - go.etcd.io/etcd/pkg/v3: [v3.6.8 → v3.7.0](https://github.com/etcd-io/etcd/compare/pkg/v3.6.8...pkg/v3.7.0)
  • - go.etcd.io/etcd/server/v3: [v3.6.8 → v3.7.0](https://github.com/etcd-io/etcd/compare/server/v3.6.8...server/v3.7.0)
  • - go.etcd.io/raft/v3: [v3.6.0 → v3.7.0](https://github.com/etcd-io/raft/compare/v3.6.0...v3.7.0)
  • - go.opentelemetry.io/contrib/detectors/gcp: [v1.39.0 → v1.43.0](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/detectors/gcp/v1.39.0...detectors/gcp/v1.43.0)
  • - go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful: [v0.65.0 → v0.69.0](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/instrumentation/github.com/emicklei/go-restful/otelrestful/v0.65.0...instrumentation/github.com/emicklei/go-restful/otelrestful/v0.69.0)
  • - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: [v0.65.0 → v0.68.0](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/instrumentation/google.golang.org/grpc/otelgrpc/v0.65.0...instrumentation/google.golang.org/grpc/otelgrpc/v0.68.0)
  • - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: [v0.65.0 → v0.69.0](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/instrumentation/net/http/otelhttp/v0.65.0...instrumentation/net/http/otelhttp/v0.69.0)
  • - go.opentelemetry.io/contrib/propagators/b3: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/propagators/b3/v1.40.0...propagators/b3/v1.44.0)
  • - go.opentelemetry.io/otel: [v1.41.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/v1.41.0...v1.44.0)
  • - go.opentelemetry.io/otel/exporters/otlp/otlptrace: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/exporters/otlp/otlptrace/v1.40.0...exporters/otlp/otlptrace/v1.44.0)
  • - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/exporters/otlp/otlptrace/otlptracegrpc/v1.40.0...exporters/otlp/otlptrace/otlptracegrpc/v1.44.0)
  • - go.opentelemetry.io/otel/exporters/stdout/stdouttrace: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/exporters/stdout/stdouttrace/v1.40.0...exporters/stdout/stdouttrace/v1.44.0)
  • - go.opentelemetry.io/otel/metric: [v1.41.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/metric/v1.41.0...metric/v1.44.0)
  • - go.opentelemetry.io/otel/sdk: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/sdk/v1.40.0...sdk/v1.44.0)
  • - go.opentelemetry.io/otel/sdk/metric: [v1.40.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/sdk/metric/v1.40.0...sdk/metric/v1.44.0)
  • - go.opentelemetry.io/otel/trace: [v1.41.0 → v1.44.0](https://github.com/open-telemetry/opentelemetry-go/compare/trace/v1.41.0...trace/v1.44.0)
  • - go.opentelemetry.io/proto/otlp: [v1.9.0 → v1.10.0](https://github.com/open-telemetry/opentelemetry-proto-go/compare/otlp/v1.9.0...otlp/v1.10.0)
  • - go.yaml.in/yaml/v2: [v2.4.3 → v2.4.4](https://github.com/yaml/go-yaml/compare/v2.4.3...v2.4.4)
  • - golang.org/x/crypto: [v0.47.0 → v0.54.0](https://go.googlesource.com/crypto/+/506e022208b864bc3c9c4a416fe56be75d10ad24^1..cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62/)
  • - golang.org/x/exp: [944ab1f → 746e56f](https://go.googlesource.com/exp/+/944ab1f22d936eefb8f6260ecd2053101d8d7b2a^1..746e56fc9e2fafde18176275ce0b96b06ac53955/)
  • - golang.org/x/mod: [v0.32.0 → v0.37.0](https://go.googlesource.com/mod/+/4c04067938546e62fc0572259a68a6912726bcdd^1..deb1dfcdb7c7fd98fb5afddc3e95dd36d5880874/)
  • - golang.org/x/net: [v0.49.0 → v0.57.0](https://go.googlesource.com/net/+/d977772e17ccaa1903b2af736f6405ab3a9f05cc^1..b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5/)
  • - golang.org/x/oauth2: [v0.34.0 → v0.36.0](https://go.googlesource.com/oauth2/+/acc38155b7f6f36aefcb58faff6f36d314dd915c^1..4d954e69a88d9e1ccb8439f8d5b6cbef230c4ef9/)
  • - golang.org/x/sync: [v0.19.0 → v0.22.0](https://go.googlesource.com/sync/+/2a180e22fddcc336475e72aa950be958c1b68d33^1..1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0/)
  • - golang.org/x/sys: [v0.40.0 → v0.47.0](https://go.googlesource.com/sys/+/2f442297556c884f9b52fc6ef7280083f4d65023^1..9e7e939dcafac07e8ab4cffa6e5fc74908413f00/)
  • - golang.org/x/telemetry: [bd525da → 59b4966](https://go.googlesource.com/telemetry/+/bd525da824e2505db9e8ac44025316bf6f43a6f6^1..59b4966ccb57499277814ee2272936a2c01cfbcd/)
  • - golang.org/x/term: [v0.39.0 → v0.45.0](https://go.googlesource.com/term/+/a7e5b0437ffa3159709172efbe396bc546550e23^1..9f69229da31ca6a34b522f59dbe07cad5ea21587/)
  • - golang.org/x/text: [v0.33.0 → v0.40.0](https://go.googlesource.com/text/+/536231a9abc69feaab8d726b5ec75ee8d3620829^1..724af9c35838492dcaacc1ac51a8a0187c994c54/)
  • - golang.org/x/time: [v0.14.0 → v0.15.0](https://go.googlesource.com/time/+/2b4e43900c03fd6b77109b7b2b6d77583f48bc1c^1..812b343c8714c317b0dad633efa6d103e554c006/)
  • - golang.org/x/tools: [v0.41.0 → v0.47.0](https://go.googlesource.com/tools/+/2ad2b30edf98d0e3b67a7b3e8f6d1d6e41c963c3^1..fbf9f2e2c8124fbe1877f5ed2857111038d9fe12/)
  • - gonum.org/v1/gonum: [v0.16.0 → v0.17.0](https://github.com/gonum/gonum/compare/v0.16.0...v0.17.0)
  • - google.golang.org/genproto/googleapis/api: [8636f87 → 3dc84a4](https://github.com/googleapis/go-genproto/compare/8636f8732409467ddc8453f81f4429397739bb17...3dc84a4a5aaa87331e10f51e22e90d961f986894)
  • - google.golang.org/genproto/googleapis/rpc: [8636f87 → 3dc84a4](https://github.com/googleapis/go-genproto/compare/8636f8732409467ddc8453f81f4429397739bb17...3dc84a4a5aaa87331e10f51e22e90d961f986894)
  • - google.golang.org/grpc: [v1.79.3 → v1.82.1](https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1)
  • - k8s.io/gengo/v2: [ec3ebc5 → 25e2208](https://github.com/kubernetes/gengo/compare/ec3ebc5fd46b84f44dfb135e9684c6567791dd8e...25e2208e0dc371a827289e7faced19a2dbcd480b)
  • - k8s.io/kube-openapi: [43fb72c → d427ff9](https://github.com/kubernetes/kube-openapi/compare/43fb72c5454a03ed83388cf20c070499ee359af8...d427ff9ee9ad05f5da435abbb7c5929cb713ac56)
  • - k8s.io/utils: [b8788ab → be93311](https://github.com/kubernetes/utils/compare/b8788abfbbc27cab6c8732274b5c2ae213868854...be93311217bd4e42d0aa42a5987d08e8f5581ec0)
  • - sigs.k8s.io/apiserver-network-proxy/konnectivity-client: [v0.34.0 → v0.36.0](https://github.com/kubernetes-sigs/apiserver-network-proxy/compare/konnectivity-client/v0.34.0...konnectivity-client/v0.36.0)
  • - sigs.k8s.io/knftables: [v0.0.21 → v0.0.22](https://github.com/kubernetes-sigs/knftables/compare/v0.0.21...v0.0.22)
  • - sigs.k8s.io/structured-merge-diff/v6: [v6.3.2 → v6.4.2](https://github.com/kubernetes-sigs/structured-merge-diff/compare/v6.3.2...v6.4.2)

fixes (123)

  • Fixed CEL cost estimation for metadata.name and metadata.generateName
  • Fixed DRA CapacityRequestPolicyRange to support fractional quantities in milli-scale.
  • Fixed Pod status validation for reported Linux container user UIDs to accept values above 2147483647 and up to the unsigned 32-bit UID limit.
  • Fixed a v1.34+ regression handling containers with environment values set from Secret API objects containing binary non-utf8 data.
  • Fixed a bug in DRA consumable capacity
  • Fixed the overestimation of a Pod's resource footprint during resize operations for multi-container Pods.
  • Preserved data in the DRA-related Pod status fields resourceClaimStatuses, extendedResourceClaimStatus, and nodeAllocatableResourceClaimStatuses when handling Pod status updates that omit those fields. This prevents updates from older clients from unsetting these DRA fields, which could leave Pods permanently stuck in Terminating.
  • Fixed a nil pointer dereference in client-go event key generation by adding nil checks in getEventKey, getSpamKey, and EventAggregatorByReasonFunc, preventing panics when processing nil events.
  • Fixed a bug in kube-scheduler when the DRADeviceTaintRules feature gate is enabled that could cause scheduler panics when DeviceTaintRules exist and ResourceSlices change, or cause new DeviceTaintRules changes to be ignored.
  • Fixed a bug where nomination of a gated pod wasn't preventing lower-priority pods from scheduling on the nominated space.
  • Changed kube-apiserver to validate the --advertise-address IP when using --endpoint-reconciler-type master-count or lease, ensuring the specified IP address can be persisted to an Endpoints API object successfully.
  • Changed kube-proxy to truncate nftables comments to the kernel's 128-byte limit before programming service maps, avoiding sync failures for long Service names.
  • DRA: Fixed a bug where a rare missed informer update of a ResourceClaim could cause Pods to remain pending until the unschedulable queue was flushed.
  • Fixed 409 Conflict errors between the PVC protection controller and the PV binder during initial PVC binding.
  • Fixed CEL behavior for set and map lists.
  • Fixed DRA scheduling bugs where the structured allocator incorrectly counted a device's shared counters while evaluating candidates.
  • Fixed Pod-level MemoryQoS memory protection (memory.min and memory.low) being silently dropped during in-place Pod resize
  • Fixed VolumeAttachment validation to report the correct maximum message size (1024 bytes) in error messages.
  • Fixed Windows CPU affinity so that, when the CPU Manager static policy and the Memory Manager are both active under the WindowsCPUAndMemoryAffinity feature gate, containers are pinned to the CPU Manager's allocated set
  • Fixed DecodeMetadataFromStream to skip only entries with unknown API versions and return errors for decode failures or malformed metadata in supported versions, preventing silent data loss.
  • Fixed kube-apiserver hanging indefinitely on SIGTERM when it could not create its identity Lease
  • Fixed kube-proxy to remove stale conntrack entries when a UDP Service no longer has any serving endpoints
  • Fixed kubectl cluster-info dump --output-directory creating world-readable dump files.
  • Fixed kubectl get storageclass to show only the effective default StorageClass as "(default)" when multiple StorageClasses have the default annotation.
  • Fixed kubelet applying device health updates to the wrong Pod status when device plugins for different resources exposed devices with identical IDs.
  • Fixed kubelet failure starting on ZFS due to missing cadvisor plugin.
  • Fixed a DRA consumable-capacity scheduling bug where a device that consumes shared counters could have them counted twice
  • Fixed a DRA issue where drivers might not recreate ResourceSlices that were deleted externally
  • Fixed a DRA partitionable devices issue where counters published by a DRA driver outside the valid int64 range could be mutated in the informer cache
  • Fixed a DRA scheduling bug where the structured allocator keyed shared-counter caches by pool name only
  • Fixed a Dynamic Resource Allocation (DRA) scheduler bug that could assign mutually exclusive device partitions to multiple Pods.
  • Fixed a kube-proxy IPVS-mode performance bug where syncProxyRules could take tens of seconds in clusters with many Services
  • Fixed a kube-proxy issue on Windows where transient HNS downtime during restart or recovery could cause incorrect LoadBalancer state reconciliation
  • Fixed a kubelet bug where init containers could be skipped when a Pod sandbox was recreated
  • Fixed a kubelet issue where Pods with subPath mounts could become stuck in an error loop after FUSE or GlusterFS network filesystem disruptions.
  • Fixed a kubelet memory leak regression in v1.36 caused by leaked contexts on every Pod sync.
  • Fixed a kubelet panic in image pull credential verification when maxParallelImagePulls is configured above 31.
  • Fixed a v1.33 regression that could cause a panic in the endpoint controller when processing services with empty IPFamilies field
  • Fixed a v1.35 regression where exec readiness probes stopped executing
  • Fixed a bug in CEL where quantity.Add mutated the receiver.
  • Fixed a bug in ImageLocality scoring where image volumes could receive a higher score than equivalent regular container images.
  • Fixed a bug in kube-apiserver where a request matching multiple ValidatingAdmissionPolicy bindings with audit actions only recorded the first validation failure in the audit annotation
  • Fixed a bug in the DRA kubelet plugin helper where drivers with names longer than ~30 characters could not enable rolling updates
  • Fixed a bug that caused Pods in a PodGroup sharing a ResourceClaim to get stuck scheduling.
  • Fixed a bug that could cause the admission controller to panic when evaluating CEL expressions against typed map lists with three keys.
  • Fixed a bug when the GenericWorkload feature gate is enabled that could prevent Pods in the same PodGroup sharing the same ResourceClaim from successfully scheduling.
  • Fixed a bug where Burstable Pod memory.low soft protection was ineffective
  • Fixed a bug where Pod .status.resourceClaimStatuses could flap between partial lists of claims when multiple claims were used in the Pod.
  • Fixed a bug where Pods in a PodGroup sharing a ResourceClaim could be scheduled to Nodes where the ResourceClaim is not available.
  • Fixed a bug where Pods that share multi-node claims and also have per-node claims can get stuck in Pending.
  • Fixed a bug where ResourceClaims using allocationMode: All with consumable capacity could be partially allocated
  • Fixed a bug where ValidatingAdmissionPolicy and MutatingAdmissionPolicy evaluation could observe subtle differences
  • Fixed a bug where kubectl drain --disable-eviction --dry-run=server hangs indefinitely.
  • Fixed a bug where a StatefulSet with the OnDelete update strategy never updated Status.CurrentRevision
  • Fixed a bug where disabling the MemoryQoS feature gate did not clear per-container memory.high cgroup values
  • Fixed a bug where enabling the DRAListTypeAttributes feature gate could prevent device allocation even when a valid combination existed.
  • Fixed a bug where kubelet would generate an event once per second for every image volume in a pod.
  • Fixed a bug where non-admitted Pods could briefly count against the allocated budget
  • Fixed a bug where pods with multiple subPath volume mounts on Windows would get stuck in Terminating state
  • Fixed a bug where successfully scheduled Pods could be stuck with the PodScheduled=False condition.
  • Fixed a bug where the kubelet node shutdown manager could leak D-Bus connections on repeated failures
  • Fixed a bug where the kubelet did not enforce per-container ephemeral-storage limits on restartable init containers (sidecar containers)
  • Fixed a case where Pods in a PodGroup that were successfully evaluated during a failed PodGroup scheduling cycle had nominatedNodeName set from that evaluation instead of from PodGroup preemption.
  • Fixed a concurrent map read/write data race in handleSchedulingFailure during scheduling failure handling.
  • Fixed a kube-scheduler panic when a DRA ResourceClaim using allocationMode: All selects a device that consumes shared counters.
  • Fixed a metrics leak in the scheduler PriorityQueue
  • Fixed a panic caused by integer division by zero and incorrect ResourceSlice admission validation
  • Fixed a panic in ResourceSlice validation that could occur when the DRAConsumableCapacity feature gate was enabled
  • Fixed a panic in kube-controller-manager that could occur when a StorageVersionMigration targeted a resource missing from the RESTMapper
  • Fixed a race condition in preemption, where a preemptor pod could get stuck in unschedulable state.
  • Fixed a race in kubelet where PrepareResources could attach a Pod to a ResourceClaim that was concurrently being unprepared
  • Fixed a regression in Kubernetes v1.35 where, with a Parallel Pod management policy, unavailable Pods from an older revision were incorrectly counted toward the maxUnavailable budget.
  • Fixed a regression in Server-Side Apply where patching a container type (list or map) could return 422 required errors for apply requests that previously succeeded.
  • Fixed a regression in v1.36 where modifications to scheduling directives (nodeSelector, tolerations, nodeAffinity) on suspended Jobs were rejected
  • Fixed a regression in retrying deferred resizes caused by changes to Pod resource footprint calculation.
  • Fixed a regression where the Job controller could report status.active as 0 while replacement Pod creation was deferred due to pod-failure backoff
  • Fixed a regression where the kubelet did not clear stale cgroup v2 memory.min and memory.low values when the MemoryQoS feature gate was disabled after being previously enabled.
  • Fixed a scheduler bug in DRA consumable capacity where a ResourceSlice with a device capacity requirement stored as a high-precision decimal
  • Fixed a scheduler bug where clearing NominatedNodeName could leave Pods tracked under an empty node key in the scheduler's nominator.
  • Fixed a scheduler cache bug where assumed Pods were not removed correctly from PodGroupState after receiving a deletion timestamp.
  • Fixed admission handling so that updates to namespaced objects that still exist after their namespace was deleted are allowed.
  • Fixed an issue in the CronJob controller where it failed to adopt existing Jobs by erroneously using the empty namespace from the jobTemplate.
  • Fixed an issue that could cause duplicate configuration entries to be reported in ResourceClaim status.
  • Fixed an issue where PodGroup preemption that detected an ongoing preemption would clear nominatedNodeName on the PodGroup's Pods.
  • Fixed an issue where the StatefulSet controller's skip metrics were not properly registered.
  • Fixed an issue where the kubelet would delete the CSI mount directory when a periodic NodePublishVolume call (triggered by setting CSIDriver.spec.requiresRepublish to true) returned an error
  • Fixed audit logging of malformed patch request bodies.
  • Fixed capacity accounting in the DRA consumable-capacity allocator.
  • Fixed duplicate logs when trying to attach to a pod fails.
  • Fixed duplicated mount arguments in log string output from MakeMountArgsSensitiveWithMountFlags.
  • Fixed handling of a certificate authority path outside the .kube/config directory on Windows
  • Fixed inconsistent ephemeral-storage formatting between capacity and allocatable values in Node status
  • Fixed incorrect error message formatting in the HPA controller when object metric retrieval fails.
  • - Fixed inter-pod affinity, anti-affinity, and volume restriction evaluation in kube-scheduler during PodGroup scheduling cycles. The scheduler snapshot's AssumePod and ForgetPod methods correctly maintain affinity node lists and PVC usage tracking.
  • - Fixed nil pointer dereference in Windows memory eviction threshold notifier when GetPerformanceInfo() fails.
  • - Fixed queue hint for inter-pod anti-affinity in case there are multiple terms, which might have caused delays in scheduling.
  • - Fixed regression in kubectl resource printing on bigger data sets (100+ rows).
  • - Fixed stale remote HNS endpoint cleanup on Windows when a pod IP is reused across nodes in L2Bridge networks, preventing DNS timeouts caused by traffic being routed to the wrong node.
  • - Fixed the DRA kubelet plugin helper repeating the listen error instead of reporting why removing a stale Unix domain socket failed when it could not start its listener.
  • - Fixed the ResourceClaim controller mutating the shared informer cache when creating a ResourceClaim from a ResourceClaimTemplate that has annotations.
  • - Fixed the kube-apiserver to create metadata fields for create-via-update and created-via-apply requests like they are for create requests. UID and resourceVersion preconditions are still honored.
  • - Fixed the error message from PodGroupPostFilter to contain the correct extension point name.
  • - Fixed the inconsistency between opportunistic batching and PodGroups that made the batching hints always infeasible during PodGroup scheduling cycle.
  • - Fixed the wrong cause of the UnexpectedJob event/warning by checking the owner reference of the job correctly in the cron job controller.
  • - Improved kubeadm join reliability by using the KubernetesAPICall timeout (default 1 minute) when fetching the kubeadm-config ConfigMap from the cluster, instead of the short 350ms retry previously used for optional component configs. A new shortConfigMapGet parameter was added to FetchInitConfigurationFromCluster so that callers like kubeadm reset can still use the short retry.
  • - Improved scheduler handling of large PodGroups by reducing the likelihood of scheduling stalls when member Pods transiently fail to bind to Nodes, such as when many Pods share the same ResourceClaim.
  • - Improved the resilience of kubeadm etcd learner promotion by correctly handling cases where promotion succeeds but a transient client-side error is returned, preventing unnecessary etcd-join failures.
  • - Fixed kubelet to recover from corrupted subpath mount points (for example, stale NFS file handle) during container restart instead of leaving the pod stuck in CreateContainerConfigError.
  • - Updated the kubelet to emit FailedToRetrieveImagePullSecret events only when an image pull has failed.
  • - Updated the pods/binding subresource endpoint to validate the specified node name consistently.
  • - kubeadm: Changed kubeadm join to return a clear error message when the TLS bootstrap kubeconfig has a current-context that does not appear in the contexts list, instead of panicking with a nil pointer dereference.
  • - kubeadm: Changed cluster-info discovery over HTTPS to check the HTTP response status code, so a non-200 response produces a clear error instead of a confusing kubeconfig parse failure.
  • - kubeadm: Fixed MemberPromote to skip the etcd promote API call when the member is already a voting member, avoiding unnecessary retries and timeout.
  • - kubeadm: Fixed a panic in kubeadm PKI key loading when the private key type and public key type mismatch.
  • - kubeadm: Fixed kubeadm init phase certs --dry-run to correctly copy existing CA files.
  • - kubelet/DRA: Fixed a bug where retrying a partially failed PrepareResources caused duplicate CDI device IDs to be passed to the CRI runtime, which could cause container start to fail.
  • - kubelet: Fixed a goroutine leak on shutdown by making the eviction manager's monitoring goroutine exit promptly when the kubelet context is cancelled.
  • - kubelet: Fixed incorrect Pod-level CPU requests reported in status from the cgroup v2 readback.
  • - DRA: Fixed a potential crash in the scheduler, recovered after restart, when the ResourceSlice tracker encountered an OnDelete event for a DeviceTaintRule whose deleted object is unknown.
  • - Fixed a bug in kubelet DRA where deleting a Pod could unprepare resources still in use by another Pod.
  • - Fixed a race condition where server-side apply requests for custom resources could observe an updated CustomResourceDefinition before the apply path was fully synchronized, causing inconsistent dry-run behavior.
  • - Fixed a theoretical issue where nodes might have been denied access to synthesized ResourceClaims for pods using extended resources (for example, nvidia.com/gpu), causing containers to get stuck in ContainerCreating. Not observed in practice.
  • - Fixed server-side apply to correctly drop status changes when tracking field ownership for PodGroup, PodCompositeGroup, and PodCertificateRequest.

additions (75)

  • Updated the kubelet to log its effective configuration at startup.
  • Added Alpha support for DRA device compatibility groups
  • Added Alpha support for binding service account tokens to webhook configurations with attestations
  • Added Alpha support for defining the file owner of atomically written volume files
  • Added CompositePodGroup support to the building block APIs and the workloadbuilder library.
  • Added Workload-aware scheduling (WAS) support to the Job controller
  • Added CheckpointPod and RestorePod RPCs to the CRI v1 RuntimeService API
  • Added a PreemptionPolicy field to PodGroup
  • Added a protocol field to httpGet probes
  • Added a defense-in-depth check to the NodeRestriction admission plugin for PodCertificateRequests.
  • These accounting fixes change the numbers reported in v1.36.
  • Added an opt-in userspace TCP proxy to the nftables kube-proxy backend
  • Added dry-run support to unsafe corrupt object deletion
  • Added scheduler support for preempting lower-priority Pods
  • Added support for dynamically resizing memory-backed volumes
  • setting Unix permission bits (0000-01777) through the mode field
  • specifying bind mount options (noexec, nodev, nosuid) per container volume mount.
  • Added the API changes required for reporting volume health.
  • Added the CompositePodGroup API to scheduling.k8s.io/v1alpha3.
  • Added the Recreate update strategy for StatefulSet
  • Added the --concurrent-disruption-syncs flag
  • Added the .spec.evictionResponders Pod field, along with the EvictionRequest and Eviction resources.
  • Added the DefaultPodSysctls kubelet configuration field
  • Added the GracefulNodeShutdownInProgress, DrainInProgress, Drained, MaintenancePlanned, and MaintenanceInProgress Node lifecycle conditions.
  • Added the PodGroupPostFilter extension point
  • Added the PreemptionPolicy field to PodGroupTemplate
  • improving scheduling throughput.
  • Added the core machinery for Conditional Authorization
  • Added Alpha support for DRAOptionalNodeOperations
  • PersistentVolumeClaims report the Unused condition
  • adds the preventPodSchedulingIfMissing field to CSIDriver
  • Added TLS support for gRPC container probes
  • Added GROUP, SCOPE, VERSIONS, and CREATED AT columns to kubectl get crd output
  • Added Prometheus metrics for Windows kube-proxy (winkernel) load balancer operation failures
  • Added ServiceName, PodManagementPolicy, and PersistentVolumeClaimRetentionPolicy to kubectl describe statefulset output.
  • Added a --max-depth flag to kubectl explain --recursive to limit the depth of nested fields displayed in the output.
  • Added a warning when kube-proxy is started without an explicitly specified proxy mode (such as iptables, ipvs, or nftables), because the default mode on Linux will switch from iptables to nftables in a future release.
  • Added an Alpha feature gate, ConsistentListFromCacheSkipTimeoutFallback. When enabled, kube-apiserver returns HTTP 429 for consistent LIST requests that cannot be served from the watch cache within the timeout window, instead of falling back to storage.
  • Added an error outcome to the route_sync_total metric for failed route reconciles, alongside the existing changed and noop outcomes.
  • Added metric apiserver_watch_cache_initialization_duration_seconds recording the duration of the most recent watch cache initialization, labeled by group and resource.
  • Added metrics for informer activity in kube-apiserver.
  • Added progress reporting to StorageVersionMigration conditions, allowing users to see how many objects a migration has processed.
  • Added scheduler metrics for the topology-aware scheduling (TAS) placement phases, available when the TopologyAwareWorkloadScheduling feature gate is enabled: scheduler_generated_placements_total, scheduler_placement_evaluations_total, and scheduler_placement_evaluation_duration_seconds.
  • Added the Alpha apiserver_watch_events_dispatch_duration_seconds metric, recording the duration from when a watch event is decoded from etcd until it is written to the watcher's outgoing result channel.
  • Added the Alpha kubelet metric kubelet_pod_deferred_resize_duration_seconds histogram and the priority_bucket label on the kubelet_pod_pending_resizes gauge.
  • Added the Alpha kubelet metric pod_level_resources_admission_total to track adoption of Pod-Level Resources (KEP-2837) upon Pod admission, categorized by resource configuration mode and QoS class.
  • Added the --proxy-url flag to kubectl to override the proxy URL configured in the kubeconfig.
  • Added the CompositePodGroup feature gate to enable Composite Pod Group functionality.
  • Added the EtcdRangeStream beta feature gate. The watch cache initializes by streaming objects from etcd in a single RangeStream RPC instead of paginated Range requests.
  • Added the KubeProxyIPVS feature gate in preparation for deactivating and then removing the ipvs mode of kube-proxy.
  • Added the PodGroup field to the PodGroupInfo object in kube-scheduler to enable plugins to obtain a consistent state throughout the scheduling cycle.
  • Added the allocatedPods kubelet endpoint, which surfaces the kubelet's allocated Pod spec for debugging in-place Pod resizing and other Pod update issues. Requires the KubeletAllocatedPodsEndpoint feature gate.
  • Added the client-go informer metrics informer_store_resource_version, informer_queued_items, and informer_processing_latency_seconds to kube-scheduler, labelled name="kube-scheduler".
  • Added the owner_api_group and owner_api_kind labels to the dynamic_resource_allocation_resourceclaim_creates_total metric to distinguish ResourceClaims created for Pods from those created for PodGroups under the DRAWorkloadResourceClaims feature gate.
  • Added the queued_entities and queue_incoming_entities_total scheduler metrics.
  • Added the trigger (periodic or node_change) and outcome (changed or noop) labels to the Alpha route controller metric route_controller_route_sync_total.
  • Added the scheduler extension point PlacementFeasible to allow early termination of the PodGroup scheduling cycle.
  • Added the standard device attribute resource.kubernetes.io/numaNode and sysfs-based helper functions for DRA drivers.
  • Applied --field-selector to pod metrics when invoking kubectl top pod.
  • Enhanced Pod-by-Pod preemption to support PodGroups as preemption victims.
  • Made it possible for authorizers to return conditional decisions in addition to unconditional (Allow/Deny/NoOpinion).
  • Retried binding API calls in kube-scheduler when a transient error occurs.
  • Set the KUBECTL_PATH environment variable to the path of the kubectl binary when it executes a plugin.
  • Added three different subtypes of the cluster event resource "Pod": "AssignedPod", "UnscheduledPod", "TargetPod".
  • kubeadm: Added the kubeproxydaemonset patch target to allow patching the kube-proxy DaemonSet during kubeadm init and kubeadm upgrade, consistent with the existing corednsdeployment patch target.
  • Added apiserver_storage_list_duration_seconds, a metric measuring end-to-end apiserver list latency (etcd read plus object decode), labelled by whether etcd RangeStream was used, so streamed and non-streamed lists can be compared directly.
  • added Pod-level memory.high enforcement when the PodLevelResources feature gate is enabled.
  • - Generated metadata.generation and status.observedGeneration fields in HorizontalPodAutoscaler resources.
  • - client-go: Added support for waiting for in-progress event handler runs to complete before closing the event handler.
  • - kubeadm: Changed kubeadm init so that, when the default admin.conf and super-admin.conf paths are used, the files are loaded but in-memory kubeconfigs are constructed pointing to InitConfiguration.localAPIEndpoint instead of ClusterConfiguration.controlPlaneEndpoint. This resolved issues with delayed load balancers that are provisioned only after the first kube-apiserver instance starts.
  • - kubeadm: Used a dedicated ClusterRole system:kubelet-api-admin for the kube-apiserver kubelet client.
  • - kubelet: Populated involvedObject.uid on node events on a best-effort basis once the node is registered, so node events can be correlated by UID, for example in kubectl describe node. The UID is resolved once and not refreshed afterward. If a node is deleted and recreated with a new UID while the kubelet keeps running, its events continue to use the original UID until the kubelet restarts.
  • - kubelet: Set cgroup v2 memory.high for BestEffort containers when MemoryQoS is enabled (per KEP-2570).
  • - Added the HasValidationFunc method to runtime.Scheme to report whether a declarative validation function is registered for a type.
  • - Logged a warning in the kubelet if a static Pod defines an invalid priority or priorityClassName.

constraints (17)

  • Added support for derived attributes in DRA
  • selecting ResourceSlices by pool name with the field selector spec.pool.name
  • must explicitly select which versions to support in their metadata output.
  • Relaxed container security context validation so that updates to Pods may set allowPrivilegeEscalation together with CAP_SYSADMIN.
  • allow modifying minCount after creation.
  • Added metrics.k8s.io/v1 support to kubectl top.
  • Added net.ipv4.tcp_slow_start_after_idle and net.ipv4.tcp_notsent_lowat to the allowed safe sysctls list.
  • Added support for CBOR encoding in discovery endpoints and structured error responses when the CBORServingAndStorage feature gate is enabled.
  • Added the 90s, 120s, 180s, and 300s buckets to the watch_list_duration_seconds metric.
  • Added validation to PodGroup scheduling that, when the PodGroupPreemptionPolicy feature gate is enabled, ensures that the preemption policies of Pods being evaluated for scheduling match the priority of the PodGroup.
  • Added validation to PodGroup scheduling which ensures priorities of the evaluated pods match the priority of the PodGroup.
  • Reduced the scope of EventedPLEG to only accelerate detection of unexpected container terminations.
  • Updated PodGroup scheduling to skip PostFilter plugins for Pods in a PodGroup cycle. Instead, PodGroupPostFilter runs only when the entire PodGroup is unschedulable.
  • kubeadm: The preflight check ContainerRuntimeVersion validates if the installed container runtime supports the RuntimeConfig gRPC method. For older kubelet versions than v1.38, it will return a preflight warning.
  • - kubeadm: Changed the etcd cluster status check to use a quorum approach instead of considering the health of all members, so the check no longer fails when there are sufficient healthy voting members.
  • - Changed client-go to request v2 for aggregated discovery instead of falling back to v2beta1.
  • - Updated DRA so that the ResourceClaim controller creates ResourceClaims from ResourceClaimTemplates referenced by a Pod that is a member of a PodGroup only when the DRAWorkloadResourceClaims feature gate is enabled. This prevents creating a ResourceClaim for an individual Pod when it is intended to be created for the PodGroup.

defaults (10)

  • Changed kubeadm to explicitly set KubeProxyConfiguration.mode to iptables when KubeProxyConfiguration is not provided or when the mode field is empty.
  • enabled them by default.
  • memory.high is not set unless explicitly configured.
  • enabled it by default.
  • The storagemigration.k8s.io/v1 API group is enabled by default.
  • Added the WatchListCompression feature gate (Beta, enabled by default) to compress WatchList responses with gzip for clients that send Accept-Encoding: gzip. Regular Watch requests are unaffected.
  • Graduated the ConcurrentWatchObjectDecode feature gate to Beta, enabled by default.
  • Graduated the ManifestBasedAdmissionControlConfig feature gate to Beta and enabled it by default.
  • Promoted the PodLevelResourceManagers feature gate to Beta, enabled by default.
  • - kubeadm: Skipped LocalAPIEndpoint defaulting on kubeadm join for worker nodes.

renames (5)

  • Moved the NodeSyncPeriod field from KubeCloudSharedConfiguration to CloudControllerManagerConfiguration.NodeLifecycleController.NodeMonitorPeriod.
  • Renamed signal enum keys in cri-api
  • Renamed the PodGroup condition PodGroupScheduled to PodGroupInitiallyScheduled
  • replace PodGroupTemplateRef with WorkloadRef
  • - kube-controller-manager and kube-scheduler both expose dynamic_resource_allocation_resourceclaim_creates_total as a metric for the number of ResourceClaims created, replacing the differently named metrics in each component. The kube-controller-manager metric resource_claims was moved to the same dynamic_resource_allocation subsystem.

removals (2)

  • cAdvisor application/custom metrics are no longer collected
  • The /metrics/cadvisor series container_cpu_load_average_10s, container_cpu_load_d_average_10s, and container_tasks_state are no longer exported.
Kubernetes 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Kubernetes 릴리스 전체 →